Reversing Mobile Malware
summary
Live analysis of the simbad campaign shows a long‑running over service that polls a Parse C2, returns app lists or an apk module and either opens store URLs with a screen overlays webview to generate fraudulent CPI clicks or silently installs APKs without user consent; testing uses an Android emulator, transparent proxy + cert, busybox and simple file‑snapshot diffs (scripts on GitHub), and the campaign is tied to roughly 200 apps per reports and a still‑online backend.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:34The SimBad Campaign
- 8:16Artifact Collection - Permissions
- 11:08Artifact Collection - Entry Points
- 19:53Dynamic Analysis - Network Monitoring
- 20:57Dynamic Analysis - File Monitoring
- 23:37Static Analysis - Trying Side Door #1: UnlockReceiver
- 24:26Over Service: Launches Screen Overlays
- 26:35Over Service: Installing APKs from C2 Server
related talks
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
29mA Day in the Life of a Mobile Malware Reverse Engineer
30m"Latest Android threats and their techniques"
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
26mThe Secret Life of Sandworms